October is Cyber Security Awareness Month. For small and growing businesses, it is a useful prompt to review the controls that matter every day, not just when a major cyber incident appears in the news.
The basics remain remarkably consistent: protect email and online accounts, keep devices and software current, maintain recoverable backups, train people to recognise suspicious activity, and know what to do when something goes wrong.
The National Cyber Security Centre says that small organisations are just as exposed to online crime as larger ones, and its current guidance says around half of small businesses experience a cyber incident each year. That makes cyber security a routine business risk rather than simply an IT issue.
1. Start with email and identity
Email is still one of the most common routes into a business. A compromised mailbox can be used to steal information, reset passwords, impersonate staff or change payment details.
Businesses should make sure multi factor authentication is enabled wherever possible, especially for Microsoft 365, Google Workspace, banking, accounting and remote access. Passkeys are also worth adopting where services support them. Administrator accounts should be separate from normal day to day accounts, and old or unused accounts should be removed promptly.
For Microsoft 365 environments, it is also worth reviewing sign in risk, suspicious forwarding rules, legacy authentication and who has privileged roles. Our Microsoft 365 services include security reviews as well as day to day management.
2. Keep devices, applications and edge systems current
Cyber criminals routinely exploit known vulnerabilities in operating systems, browsers, applications, firewalls, VPNs and other internet facing devices. Patching is therefore one of the highest value controls a business can maintain.
Updates should cover more than Windows itself. Browsers, productivity software, line of business applications, mobile devices, routers, firewalls and remote access platforms all need attention. Old systems that are no longer supported should have a clear replacement plan rather than being left indefinitely.
The NCSC published updated guidance this October on reducing the risk and impact of disruptive cyber attacks, including the importance of reducing unnecessary exposure and finding forgotten systems before attackers do.
3. Make sure backups are genuinely recoverable
A backup is only useful if it can be restored when the business needs it. Cyber Security Awareness Month is a good time to test that assumption.
Check what is actually being backed up, how long copies are retained, whether a compromised administrator could delete them, and how quickly critical systems could be restored. Microsoft 365 and other cloud platforms provide resilience and retention features, but these should not automatically be treated as a complete independent backup strategy.
Recovery testing matters just as much as seeing a successful backup status. Our recent article on testing whether your business can actually recover explains why.
4. Make reporting suspicious activity easy
People are often the first to notice something unusual. A strange login prompt, unexpected MFA request, unusual invoice, changed bank details or suspicious email can all be early warning signs.
Staff should know exactly how to report concerns and should be encouraged to report quickly. The aim is not to catch people out. It is to make sure a possible incident reaches the right person before it becomes a larger problem.
Simple procedures can also reduce fraud. Payment detail changes should be verified through a known contact method rather than by replying to the email requesting the change.
5. Reduce the impact of a compromised account
No security control is perfect, so businesses should also plan for the possibility that an account or device is compromised.
Use least privilege, restrict administrator access, remove access when staff leave, and avoid sharing accounts. Where practical, separate critical systems and make sure remote access is limited to the people who genuinely need it.
These controls do not prevent every incident, but they can stop a single stolen password from becoming a business wide compromise.
6. Know what is visible from the internet
Businesses often accumulate systems over time: old remote access services, unused websites, test environments, forgotten DNS records, supplier portals and devices that nobody remembers deploying.
Knowing your external attack surface is increasingly important. Review what is publicly reachable, close services that are no longer required and make sure the systems that must remain online are patched and monitored.
7. Have a simple incident and recovery plan
When an incident happens, the first hour is not the time to decide who should be called or where the backups are.
A practical incident plan should cover who has authority to make decisions, how staff communicate if normal systems are unavailable, how compromised accounts or devices are isolated, who contacts customers or suppliers where necessary, and how critical services are restored.
This links cyber security directly to business continuity. Security is not only about preventing an attack. It is also about limiting disruption and recovering safely.
8. Use the free NCSC resources
The National Cyber Security Centre provides practical guidance specifically for UK small and medium sized organisations. Its current resources include the Cyber Action Toolkit, Check Your Cyber Security, the Small Organisations Guide and information about Cyber Essentials.
You can start with the NCSC guidance for small and medium sized organisations.
Cyber security should be routine, not seasonal
Cyber Security Awareness Month is useful because it creates a reason to stop and review. The real objective, however, is to make these checks routine throughout the year.
For most smaller businesses that means concentrating on a manageable set of controls: secure identities, protected email, maintained devices, tested backups, sensible access permissions, staff awareness and a recovery plan.
ML Services works with businesses across Sussex on cyber security, Microsoft 365, managed devices, backups and business continuity. If you want an independent review of where the gaps are, contact us and we can work through the practical priorities.